CVE-2024-47060 Unauthorized Access After Organization or Project Deactivation in Zitadel

Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized acces...

CVE-2024-47060 Unauthorized Access After Organization or Project Deactivation in Zitadel

Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized acces...

GHSA-JJ94-6F5C-65R8 ZITADEL Allows Unauthorized Access After Organization or Project Deactivation

Summary In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized access. Additionally, if a project was deactivated...

PT-2024-32379 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: Zitadel versions prior to 2.54.10 Zitadel versions from 2.55.0 through 2.55.7 Zitadel versions from 2.56.0 through 2.56.5 Zitadel versions from 2.57.0 through 2.57.4 Zitadel versions from 2.58.0 through 2.58.4 Zitadel versions from 2.59.0...

CVE-2022-25777

CVE-2022-25777 affects Mautic with a Server-Side Request Forgery (SSRF) in the Asset section. An authenticated user could read system files and access internal addresses of the application. Mitigation: patch to Mautic 4.4.12 or later or 5.0.4 or later (per PT-2024-11539 and related advisories). I...

CVE-2022-25776

The CVE-2022-25776 issue affects Mautic prior to patched versions. Affected product: Mautic (open-source marketing automation). Vulnerability: logged-in users can access areas of the application they should be denied, enabling potential exposure of sensitive data (names, surnames, company names, ...

CVE-2022-25775

CVE-2022-25775 affects Mautic, specifically the Reports bundle. The vulnerability is an SQL injection in dynamic Reports, allowing an authenticated, logged-in user to retrieve and alter data, potentially exposing sensitive information, compromising credentials, and, depending on database permissi...

CVE-2021-27916

CVE-2021-27916 concerns Mautic’s GrapesJS builder. Reports describe a Relative Path Traversal/Arbitrary File Deletion vulnerability in the GrapesJS implementation, enabling logged-in users (any access level) to delete files outside media folders, including system files and libraries. The vulnerab...

CVE-2021-27915

The CVE-2021-27915 entry concerns Mautic with a stored XSS vulnerability in the description fields, exploitable by a logged-in user with the appropriate permissions. Evidence across sources confirms the vulnerable component is the description field and the root cause is insufficient sanitization ...

CVE-2024-21743

CVE-2024-21743 is a Privilege Escalation in the favethemes Houzez Login Register WordPress plugin (houzez-login-register) affecting versions ≤ 3.2.5. The issue enables authenticated users (Subscriber level) to escalate privileges, effectively via an account takeover vector; it is described as a S...

HackerOne: Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation

Vulnerability description not provided...

MISP 安全漏洞

MISP is an open source software solution from MISP Open Source. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.198...

CVE-2024-39925

An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a...

CVE-2024-6582

CVE-2024-6582 describes a broken access control in lunary-ai/lunary where the saml.ts component allows a user from one organization to modify IDP settings and view SSO metadata of another organization, potentially enabling unauthorized access and account takeover if a target email is known. This ...

Lunary 安全漏洞

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in Lunary that stems from improper controls in the saml.ts file, which can be exploited by an attacker to cause unauthorized access and potential account takeover, where a user of an...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API written in Rust by Daniel García Personal Developer. A security vulnerability exists in Vaultwarden version 1.30.3, which stems from a failure to adequately protect certain encrypted data stored on the server, and allows...

CVE-2024-39925

An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a...

CVE-2024-39925

Vaultwarden (1.30.3) suffers an offboarding/key rotation flaw: when members leave, the shared organization key is not rotated, allowing departing users to retain key material and potentially decrypt data. In addition, an authenticated user could access encrypted data across organizations if they ...

CVE-2024-39925

An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a...

CVE-2024-39925

An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a...